VFS Global Bug Bounty Program
Bounty Range
$5 - $1,500
external program
Bounty Range
$5 - $1,500
external program
Bounty
$5 Low $50 Medium $300 High $800 Critical $1,500
Avg reward -
Max reward -
Scopes41
Supported languagesEnglish
Reports2059
1st response < 1 day
Reports last 24h8
Reports last week16
Reports this month66
Program description
VFS Global is the world's largest visa outsourcing and technology services specialist for governments and diplomatic missions worldwide. The company manages the administrative and non-judgmental tasks related to visa, passport and consular services for its client governments. This enables them to focus entirely on the critical task of assessment.
At VFS Global, we recognize the important role that security researchers play in helping to keep VFS Global sites and our customers secure.
By participating in this program you acknowledge that you have read and agreed to the Program Rules, which is defined as this entire document.
Please adhere to the following rules while performing research on this program:
Denial of service (DoS) attacks on VFS Global applications, servers, networks or infrastructure are strictly forbidden.
Avoid tests that could cause degradation or interruption of our services.
Do not use automated scanners or tools that generate large amount of network traffic.
Only perform tests against your own accounts to protect our users' privacy.
Do not leak, manipulate, or destroy any user data or files in any of our applications/servers.
Do not copy any files from our applications/servers and disclose them.
No vulnerability disclosure, full, partial or otherwise, is allowed.
We would be focusing on vulnerabilities of practical impacts that we would rate as CRITICAL (max $1500):
Leak / Dump of visa applicant PII data.
Insecure Direct Object References (IDOR) issues resulting in significant leak of sensitive user information (one user able to see data of another user) depending on the extent of data leaked.
Scripts that can automate the completion of the user registration flow are of interest to us. To clarify, the user registration flow includes booking a time slot for visa appointment, such that all the available time slots can be blocked, and real users are denied of making an appointment.
Researchers are encouraged to identify issues in our applications which will allow them to tamper / change the applicant name while rescheduling an appointment. For e.x an appointment has been booked in one person’s name but during rescheduling, the name is changed to some other person’s name. Such issues identified would be eligible for a bounty amount of USD 2000.
We are happy to thank everyone who submits valid reports which help us improve the security of VFS Global, however only those that meet the following eligibility requirements may receive a monetary reward:
You must be the first reporter of a vulnerability.
The vulnerability must be a qualifying vulnerability (see below).
The report must contain the following elements:
Clear textual description of the vulnerability, how it can be exploited, the security impact it has on the application, its users and VFS Global, and remediation advice on fixing the vulnerability
Proof of exploitation: screenshots and/or videos demonstrating the exploit was performed, and showing the final impact
Provide complete steps with the necessary information to reproduce the exploit, including (if necessary) code snippets, payloads, commands etc
You must not break any of the testing policy rules listed above
You must not be associated directly either currently or in the past with any company/organization in the same line of business as VFS.
You must not be a former or current employee of VFS Global or one of its contractors or suppliers.
Refrain from uploading any POC videos through youtube and provide a secure download link for us to access/download it instead. Failure to comply to this may result in ineligibility for a reward.
Reward amounts are based on:
Reward grid of the report's scope
CVSS scoring and actual business impact of the vulnerability upon performing risk analysis
We are interested in vulnerabilities of practical impacts.
The below scenario could make your report qualified for a higher Critical reward (up to $1500):
Leak / Dump of visa applicant PII data.
Insecure Direct Object References (IDOR) issues resulting in significant leak of sensitive user information (one user able to see data of another user) depending on the extent of data leaked.
Scripts that can automate the completion of the user registration flow are of interest to us. To clarify, the user registration flow includes booking a time slot for visa appointment, such that all the available time slots can be blocked, and real users are denied of making an appointment.
Researchers are encouraged to identify issues in our applications which will allow them to tamper / change the applicant name while rescheduling an appointment. For e.x an appointment has been booked in one person’s name but during rescheduling, the name is changed to some other person’s name. Such issues identified would be eligible for a bounty amount of USD 1,000+.
Researchers are encouraged to identify issues in facial verification feature in our below applications which will allow them to tamper / change the applicant details or photo while rescheduling an appointment. For e.x an appointment has been booked in one person’s name and photo but the name and photo is changed to some other person’s name. Such issues identified would be eligible for an additional bounty amount of USD 500. This feature is enabled on the login urls below:
For other findings such as payment tampering / bypass, login bypass / access control issues, where there is no or less significant impact to VFS as compared to above, then the bounty amount will be up to 700 USD.
VFS retains the sole authority to determine and reward accordingly to our analysis.
Insecure Direct Object References (IDOR) issues resulting in significant leak of sensitive user information will usually be rewarded as High/Critical depending on the extent of data leaked.
Note: In findings where the researcher claims he/she can get access to another applicant data, only findings where the researcher has no knowledge of the other applicant related information and was able to successfully to get access to the same by any other means (for e.x. brute force / parameter tampering / data manipulation, etc.) will be considered as valid.
If the researcher creates 2 applicants and from one applicant login, he/she was able to get access to another applicant data (since he/she was aware of the same) will not be counted as a valid finding.
Scripts that can automate the completion of the user registration flow are of interest to us, and will be rewarded as High/Critical. To clarify, the user registration flow includes booking a time slot for visa appointment, such that all the available time slots can be consumed, and real users are denied of making an appointment.
The triage team will use the "OneFixOneReward" process: if two or more endpoints/forms use the same code base and a single fix can be deployed to fix all the others weakness, only one endpoint will be considered as eligible for a reward and other reports will be closed as Informative. In any case, all reports will be reviewed edge by edge.`
Rating | CVSS score | Bounty |
None | 0.0 | No bounty |
Low | 0.1 - 3.9 | $50 |
Medium | 4.0 - 6.9 | $100 - 300 |
High | 7.0 - 8.9 | $400 – 800 |
Critical | 9.0 - 10.0 | $1000 - 1500 |
Asset value | CVSS Low | CVSS Medium | CVSS High | CVSS Critical | Critical | $50 | $300 | $800 | $1,500 |
1st report100% 2nd report100% 3rd report75% 4th report50% 5th report25% 6th+ report10%
In the context of this program, we do not intend to encourage, accept or reward reports of leaks that are not applicable to our program’s scope and policy. To summarize our policy, you may refer to the below table:
More info
Scope | Type | Asset value | Expand rewards grid | *.vfsglobal.(com|co.uk|ca) | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| *.vfsevisa.com | Wildcard | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| *.onevasco.com | Wildcard | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| *.vascoworldwide.net | Wildcard | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| www.vfsvisaonline.com | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| www.dvpc.net | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| www.vfsvisaservicesrussia.com | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| *.directverify.in | Wildcard | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| *.docswallet.com | Wildcard | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| biometservices.com | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| agents.tasheer.com | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| https://gaadmin.vfsglobal.com/GlobalAdmin/ | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| https://gaadmin.vfsglobal.com/Global-Admin/ | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| https://rusadminappt.vfsglobal.com/Global-Admin/ | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| https://gaadmin.vfsglobal.com/AustraliaApptAdmin/ | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| https://gaadmin.vfsglobal.com/GAR1Ph1ApptAdmin/ | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| https://onlinena.vfsglobal.dz/AppointmentAdmin/ | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| https://gaadmin.vfsglobal.com/DHAAppointmentAdmin | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| https://equatorialguinea-evisa.com | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| https://online.srilankaevisa.lk/lka/en/login | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| https://online.mustaqel.qa/qat/en/login | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| https://appointment.vfsglobal.com.dz/forms/FRDZ/ | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| https://vfs.mioot.com/ | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| https://vfseu.mioot.com/ | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| https://www.vfsvisaservice.com/ | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| https://indonesiavoa.vfsevisa.id/ | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| https://www.vfsglobalservices-germany.com/Global-Appointment/ | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| https://www.vfsvisaservice.com/IHC-SouthKorea-Appointment | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| https://vc.tasheer.com/ | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| *.vfsglobal.by | Wildcard | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| *. vfsevisa.id | Wildcard | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| *.vfsai.com | Wildcard | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| https://cicforms.mioot.com/forms/PS/ | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| svtselb.tasheer.com | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| https://vfs-ai-tiff-image-api-hchkdabjdsdya6ea.switzerlandnorth-01.azurewebsites.net/ | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| https://vfsforms.mioot.com/forms/IFAL/ | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| ru-yandex-api-app.vfsevisa.com | API | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| https://mohesr.vfsglobal.com/forms/CVUAE/admin/ | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| phlonline.vfsevisa.cn | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| phlportal.vfsevisa.cn | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
| evisa.gov.mz | Web application | Critical | | Low $50
Medium $300
High $800
Critical $1,500
|
In the context of this program, we do not intend to encourage, accept or reward reports of leaks that are not applicable to our program’s scope and policy. To summarize our policy, you may refer to the below table:
More info
Type of leak Source of leak is in-scope Source of leak belongs to the Organization and is out-of-scope Source of leak does not belong to the Organization and is out-of-scope
Impact is in-scope (e.g. valid credentials on an in-scope asset) Eligible Eligible Not eligible
Impact is out-of-scope (e.g. valid credentials for an out-of-scope asset) Eligible Not eligible Not eligible
When submitting new report, you can add up to 5 collaborators, and define the reward split ratio.
For more information, see [https://helpcenter.yeswehack.io/hunter/hunter-collaboration](help center). Note: For reports that have already been rewarded, it is not possible to redistribute the rewards.
To submit a vulnerability report, you need to login with your hunter account. /programs/vfs-global-bug-bounty-program/create-report